https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 <H2 id="toc-hId-1673211419" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Table of contents</H2> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#summary" rel="nofollow noopener noreferrer" target="_blank">Summary</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#problem" rel="nofollow noopener noreferrer" target="_blank">Problem</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#troubleshooting-steps" rel="nofollow noopener noreferrer" target="_blank">Troubleshooting steps</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#resolution" rel="nofollow noopener noreferrer" target="_blank">Resolution</A> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>No logs from Kubernetes</STRONG> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#log-storage-rule-not-matching" rel="nofollow noopener noreferrer" target="_blank">Log storage rule not matching</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#podlistfuture-not-valid--missing-speclogmonitoring" rel="nofollow noopener noreferrer" target="_blank"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> — missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE></A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#speclogmonitoring-in-the-wrong-dynakube" rel="nofollow noopener noreferrer" target="_blank"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> in the wrong DynaKube</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#gke-autopilot--kubelet-api-blocked" rel="nofollow noopener noreferrer" target="_blank">GKE Autopilot — Kubelet API blocked</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#init-container-permission-failure-on-selinux--openshift" rel="nofollow noopener noreferrer" target="_blank">Init container permission failure on SELinux / OpenShift</A></LI> </UL> </LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>Logs visible but missing data or metadata</STRONG> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#specific-namespaces-not-ingested" rel="nofollow noopener noreferrer" target="_blank">Specific namespaces not ingested</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#container-screen-shows-no-logs-found" rel="nofollow noopener noreferrer" target="_blank">Container screen shows "No logs found"</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#custom-log-source-blocks-kubernetes-enrichment" rel="nofollow noopener noreferrer" target="_blank">Custom log source blocks Kubernetes enrichment</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#k8sdeploymentname-shows-wildcards-" rel="nofollow noopener noreferrer" target="_blank"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> shows wildcards (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE>)</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#k8sworkloadname--k8sworkloadkind-not-populated" rel="nofollow noopener noreferrer" target="_blank"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE> / <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE> not populated</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#pod-annotationbased-rules-ignored--collect-all-container-logs-toggle" rel="nofollow noopener noreferrer" target="_blank">Pod annotation–based rules ignored — <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Collect all container logs</CODE> toggle</A></LI> </UL> </LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>Log gaps and inconsistencies</STRONG> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#log-module-at-performance-limits" rel="nofollow noopener noreferrer" target="_blank">Log Module at performance limits</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#multi-line-entries-split-or-merged" rel="nofollow noopener noreferrer" target="_blank">Multi-line entries split or merged</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#timestamp-issues-causing-entries-to-be-dropped" rel="nofollow noopener noreferrer" target="_blank">Timestamp issues are causing entries to be dropped</A></LI> </UL> </LI> </UL> </LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#whats-next" rel="nofollow noopener noreferrer" target="_blank">What's next</A></LI> </OL> <HR /> <H2 id="toc-hId--878945542" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Summary</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This article helps you troubleshoot Kubernetes-specific log collection issues with Log module. It covers no logs appearing, missing or incorrect Kubernetes metadata, and gaps in container logs. It applies to Log Module deployed via OneAgent (Classic or Cloud-Native Full-Stack) or Dynatrace Operator (Kubernetes Log Module), on both SaaS and Managed environments.</P> <H2 id="toc-hId-863864793" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Problem</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">You see one of the following:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">No logs at all from Kubernetes workloads, or no logs from a specific namespace or node.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are visible in the Logs viewer, but lack Kubernetes metadata such as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>, or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are visible in the <STRONG>Logs viewer</STRONG>, but the <STRONG>Container detail</STRONG> view in the Kubernetes app shows <STRONG>No logs found.</STRONG></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Pod annotation–based ingest rules are ignored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Time-series log volume charts show periodic gaps.</LI> </UL> <H3 id="toc-hId--1884805673" class="text-text-100 mt-2 -mb-1 text-base font-bold">Kubernetes metadata attached to Container Output logs</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For reference, this is the metadata that Log Module attaches automatically to logs ingested as <STRONG>Container Output</STRONG>:</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Attribute</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Description</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Notes</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.container.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Container name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Pod name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Numbers preserved</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Deployment base name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Numbers generalized to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.uid</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Pod UID</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Namespace</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.cluster.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Cluster display name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Exact workload name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Workload kind</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dt.entity.container_group_instance</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Container entity ID</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Full-Stack OneAgent only. Used by the Container screen in the Kubernetes app</TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Key rule:</STRONG> Logs ingested as Container Output (via the container runtime) automatically receive Kubernetes metadata. Logs ingested from file-system paths via a custom log source pointing to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/...</CODE>&nbsp;<SPAN><STRONG>don't</STRONG></SPAN>.</P> <H2 id="toc-hId-54518167" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Troubleshooting steps</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Before opening a ticket or investigating a specific scenario, verify all items in this checklist.</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">#</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Check</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">How to verify</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">1</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">A log ingest rule exists for the desired logs</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt; <STRONG>Log storage configuration</STRONG>. Select the relevant scope at the top left.</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">2</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> is present in the correct DynaKube</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl get dynakube -n dynatrace -o jsonpath='{range .items[*]}{.metadata.name}{"\n\t.spec.logMonitoring: "}{.spec.logMonitoring}{"\n\t.spec.metadataEnrichment: "}{.spec.metadataEnrichment}{"\n"}{end}'</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">3</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.metadataEnrichment.enabled: true</CODE> in the DynaKube</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Same command as above</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">4</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">ActiveGate has the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubernetes-monitoring</CODE> capability</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl get dynakube -n dynatrace -o jsonpath='{range .items[*]}{.metadata.name}{"\n\t.spec.activeGate.capabilities: "}{.spec.activeGate.capabilities}{"\n"}{end}'</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">5</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No conflicting ingest rules at a higher scope override your include rule</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Check hierarchy and overrides on the Kubernetes cluster scope</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">6</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">ingest.warning</CODE> attribute on existing log records</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">DQL: <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">fetch logs | filter isNotNull(dt.ingest.warnings)</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">7</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Operator DaemonSet pods are running on every node</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl -n dynatrace get pods -o jsonpath='{range .items[*]}{.metadata.ownerReferences[0].name}{"\t"}{.spec.nodeName}{"\n"}{end}' | grep -E 'logmonitoring|oneagent'</CODE></TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If the checklist passes, match your symptoms to a scenario below.</P> <H2 id="toc-hId-1797328502" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Resolution</H2> <H3 id="toc-hId--951341964" class="text-text-100 mt-2 -mb-1 text-base font-bold">Log storage rule not matching</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Container logs don't appear in Dynatrace, even though the cluster is fully monitored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">No ingest warning is present on any record because no record exists.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log ingestion is a two-step process: source detection (automatic) and log acquisition (requires an explicit ingest rule). A source definition alone is not sufficient. It must match a rule with <STRONG>Include in storage</STRONG> set.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings</STRONG> &gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt;<STRONG> Log storage configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Select the Kubernetes cluster scope.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a rule with <STRONG>Include in storage</STRONG> that matches your target containers, namespaces, or workloads.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Verify rule order: rules execute top-to-bottom; the first match wins. A broad exclusion above your inclusion silently blocks ingestion.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Check the scope hierarchy: <STRONG>Host scope</STRONG> &gt; <STRONG>Kubernetes cluster scope</STRONG> &gt; <STRONG>Host group scope</STRONG> &gt; <STRONG>Environment scope</STRONG>. A more specific scope takes precedence.</LI> </OL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Tip:</STRONG> Add an explicit <STRONG>Exclude all</STRONG>&nbsp;rule at the bottom of the Kubernetes cluster scope to prevent fallthrough to a broad environment-level include rule.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Configuration changes propagate to agents within ~90 seconds.</P> <HR /> <H3 id="toc-hId-791468371" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> — missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE></H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The OneAgent or Kubernetes Log Module pod logs repeatedly show:</LI> </UL> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10">&nbsp;</DIV> </DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN> [containersdetector] [error] Annotation retrieval failed: PodListFuture not valid (This message was ignored N times.)</SPAN></CODE></PRE> </DIV> </DIV> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs from specific namespaces or workloads are absent.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE> are missing.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module cannot reach the Kubelet API because the DynaKube is missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE>, which grants the required RBAC.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Add <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.metadataEnrichment</CODE> to the DynaKube that contains <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE>spec: logMonitoring: {} metadataEnrichment: enabled: true</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Apply the change:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl apply -f dynakube.yaml</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If the error persists after a few minutes, restart the Log Monitoring DaemonSet:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl rollout restart daemonset -n dynatrace &lt;log-monitoring-daemonset-name&gt;</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Note for Full-Stack deployments:</STRONG> <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> does not deploy a separate Kubernetes Log Module DaemonSet when <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE> is already defined. It only activates log monitoring inside the existing Full-Stack OneAgent and grants it the RBAC needed to access the local Kubelet API.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> error does not prevent log collection — only metadata enrichment is affected. Records are still ingested, but without <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.*</CODE> attributes, they won't appear in the Kubernetes app or workload-filtered views.</P> <HR /> <H3 id="toc-hId--1760688590" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> in the wrong DynaKube</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">After adding <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> (and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE>), log collection does not improve.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> error persists.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE> must be in the same DynaKube as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>. If you have separate DynaKube objects for the ActiveGate and the OneAgent, placing the log monitoring configuration in the wrong one is silently ignored.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Move <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE> to the DynaKube that also contains <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Example of a correct split-DynaKube configuration:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10"> <DIV class="relative"> <DIV class="transition-all opacity-100 scale-100">&nbsp;</DIV> <DIV class="absolute inset-0 flex items-center justify-center"> <DIV class="transition-all opacity-0 scale-50">&nbsp;</DIV> </DIV> </DIV> </DIV> </DIV> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE># DynaKube 1: ActiveGate spec: activeGate: capabilities: - kubernetes-monitoring --- # DynaKube 2: OneAgent + Log Monitoring (BOTH must be here) spec: oneAgent: applicationMonitoring: {} metadataEnrichment: enabled: true logMonitoring: ingestRuleMatchers: - attribute: k8s.namespace.name values: - production - staging</CODE></PRE> </DIV> </DIV> <HR /> <H3 id="toc-hId--17878255" class="text-text-100 mt-2 -mb-1 text-base font-bold">GKE Autopilot — Kubelet API blocked</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">On GKE Autopilot clusters, the Log Module DaemonSet logs show:</LI> </UL> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10"> <DIV class="relative"> <DIV class="transition-all opacity-100 scale-100">&nbsp;</DIV> <DIV class="absolute inset-0 flex items-center justify-center"> <DIV class="transition-all opacity-0 scale-50">&nbsp;</DIV> </DIV> </DIV> </DIV> </DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN> [containeractivitymonitor] Kubelet API initialization failed </SPAN><SPAN> Checking Kubelet API validity: https://&lt;node-ip&gt;:10250</SPAN></CODE></PRE> </DIV> </DIV> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Most pods are missing from the Logs app; only pods with injected OneAgent are visible.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">GKE Autopilot blocks direct access to the Kubelet API endpoint for <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/proxy</CODE> requests. The default Dynatrace Operator ClusterRole grants <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/proxy</CODE>, are insufficient on Autopilot. The Kubelet API requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/pods</CODE> permission on this platform.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Workaround</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Edit the ClusterRole:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl edit ClusterRole/dynatrace-logmonitoring</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Change:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE># Before - apiGroups: [""] resources: ["nodes/proxy"] verbs: ["get"] # After - apiGroups: [""] resources: ["nodes/pods"] verbs: ["get"]</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Restart the Log Monitoring DaemonSet:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl rollout restart daemonset -n dynatrace &lt;log-monitoring-daemonset-name&gt;</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Confirm in the logs:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN>[containeractivitymonitor] [info] Kubelet API initialized. Using endpoint https://&lt;node&gt;:10250</SPAN></CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Note:</STRONG> Standard GKE clusters work with both <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/proxy</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/pods</CODE>. Only GKE Autopilot requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">nodes/pods</CODE>. A permanent fix in the official Dynatrace Operator is tracked separately.</P> <HR /> <H3 id="toc-hId-1009770791" class="text-text-100 mt-2 -mb-1 text-base font-bold">Init container permission failure on SELinux / OpenShift</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The Log Monitoring DaemonSet fails to start.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The init container (bootstrapper) can't access the required host paths and exits with a permission error.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The DaemonSet ends up in <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Init:Error</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">CrashLoopBackOff</CODE>.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">SELinux blocks the bootstrapper from accessing host paths required for Log Module setup. Most commonly seen on OpenShift, but applies to any environment with SELinux enforcement.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Add the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">feature.dynatrace.com/oneagent-privileged: "true"</CODE> annotation to the DynaKube manifest:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE>apiVersion: dynatrace.com/v1beta3 kind: DynaKube metadata: name: &lt;your-dynakube&gt; namespace: dynatrace annotations: feature.dynatrace.com/oneagent-privileged: "true" spec: ...</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Restart the DaemonSet:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl rollout restart daemonset -n dynatrace &lt;log-monitoring-daemonset-name&gt;</CODE></PRE> </DIV> </DIV> <HR /> <H3 id="toc-hId--1542386170" class="text-text-100 mt-2 -mb-1 text-base font-bold">Specific namespaces not ingested</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Some namespaces produce logs visible in Dynatrace; others do not, despite identical configuration.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Work through the common causes in order:</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Cause</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Fix</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No ingest rule for those namespaces</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Add a <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE> matcher to the ingest rule</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent is not running on the nodes hosting affected pods</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Confirm the OneAgent DaemonSet has pods on every affected node</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Custom log source conflict on <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Remove the custom source — see <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#custom-log-source-blocks-kubernetes-enrichment" rel="nofollow noopener noreferrer" target="_blank">Custom log source blocks Kubernetes enrichment</A></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Higher-priority scope has an exclude override</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Check host, host-group, and environment scopes for conflicting rules</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dynatrace</CODE> namespace is missing</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dynatrace</CODE> namespace is excluded by default. Enable <STRONG>Allow OneAgent to monitor Dynatrace logs</STRONG> under <STRONG>Settings → Collect and capture → Log Monitoring → Advanced log settings</STRONG></TD> </TR> </TBODY> </TABLE> </DIV> <HR /> <H3 id="toc-hId-200424165" class="text-text-100 mt-2 -mb-1 text-base font-bold">Container screen shows "No logs found"</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are accessible at the workload, namespace, or pod level in the Kubernetes app.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The Container detail view shows "No logs found."</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Container-level log display requires the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dt.entity.container_group_instance</CODE> attribute. This attribute is only added by the Full-Stack OneAgent. It is <STRONG>not</STRONG> added by the Kubernetes Log module or by App-Only deployments.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This is by design for App-Only and Kubernetes Log module deployments. Logs remain queryable via the Logs viewer using <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.container.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE>, etc.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If container-level display in the Kubernetes app is required, deploy Full-Stack OneAgent on the affected nodes.</P> <HR /> <H3 id="toc-hId-1943234500" class="text-text-100 mt-2 -mb-1 text-base font-bold">Custom log source blocks Kubernetes enrichment</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Kubernetes metadata (pod name, namespace, deployment name) is missing from logs, even though the cluster is fully monitored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Custom log source rules targeting <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/containers/</CODE> are present in the configuration.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">A custom log source matching Kubernetes container log directories bypasses the automatic container log detection pipeline. Log Module treats those files as plain host-level logs and does not attach <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.*</CODE> metadata.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Remove the custom log source rules that target <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/containers/</CODE>, then use ingest rules with Kubernetes matchers (such as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.annotation</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>) to control what gets ingested.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For step-by-step resolution, see <EM>Troubleshooting missing logs → Custom log source blocks Kubernetes enrichment</EM>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Warning:</STRONG> After removing path-based custom log sources, logs may stop appearing entirely if no matching ingest rule exists. Ensure an ingest rule covers Container Output before removing the custom source.</P> <HR /> <H3 id="toc-hId--608922461" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> shows wildcards (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE>)</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Filtering by <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> fails because numeric parts are replaced with <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE> (for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">pricing-service-v24</CODE> becomes <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">pricing-service-v*</CODE>).</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> is the base pod name with numeric suffixes generalized. This is by design, it groups all replica pods under a single entity, consistent with how Dynatrace entity modeling works.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Workarounds</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Use <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE> (numeric suffixes are always preserved):</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN>fetch logs </SPAN><SPAN>| filter startsWith(k8s.pod.name, "pricing-service-v24")</SPAN></CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Or upgrade to OneAgent ≥ 1.307 and Dynatrace Operator ≥ 1.4.1 and use <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>, which contains the exact workload name without generalization:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN>fetch logs </SPAN><SPAN>| filter k8s.workload.name == "pricing-service-v24"</SPAN></CODE></PRE> </DIV> </DIV> <HR /> <H3 id="toc-hId-1133887874" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE> / <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE> not populated</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs lack <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE>. These attributes are required for the Kubernetes app to display workload-level log context.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Work through the causes in order:</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Cause</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Fix</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> missing from DynaKube</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Add <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.logMonitoring: {}</CODE> to the DynaKube manifest</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.metadataEnrichment.enabled: false</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Set to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">true</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">ActiveGate missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubernetes-monitoring</CODE> capability</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Add <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">- kubernetes-monitoring</CODE> to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.activeGate.capabilities</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Expiring Kubelet API service account token</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Known issue in OneAgent ≤ 1.319; upgrade to 1.321 or later</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.logMonitoring</CODE> is in a different DynaKube than <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.oneAgent</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">See <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#speclogmonitoring-in-the-wrong-dynakube" rel="nofollow noopener noreferrer" target="_blank"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> in the wrong DynaKube</A></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The<STRONG> Collect all container logs</STRONG>&nbsp;switch is off</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">See <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#pod-annotationbased-rules-ignored--collect-all-container-logs-toggle" rel="nofollow noopener noreferrer" target="_blank">Pod annotation–based rules ignored</A> below</TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">To confirm the webhook annotated the pod:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{":\t"}{.metadata.name}{":\t"}{.metadata.annotations}{"\n"}{end}'</CODE></PRE> </DIV> </DIV> <HR /> <H3 id="toc-hId--1418269087" class="text-text-100 mt-2 -mb-1 text-base font-bold">Pod annotation–based rules ignored — <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Collect all container logs</CODE> toggle</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Pod annotation–based log ingestion rules are ignored. Logs from annotated pods are not ingested.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Whether the <STRONG>Collect all container logs</STRONG> toggle is required depends on the deployment type.</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Deployment</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Toggle required?</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Min version</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent DaemonSet (Classic / Cloud-Native Full-Stack)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Yes</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent 1.309, Operator 1.4.2</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Kubernetes Log Module (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.logMonitoring</CODE> only)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent 1.309, Operator 1.4.2</TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution (OneAgent DaemonSet only)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Turn on&nbsp;<STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture </STRONG>&gt; <STRONG>Log Monitoring </STRONG>&gt;<STRONG> Log module feature flags</STRONG> &gt;<STRONG> Collect all container logs</STRONG> at the Kubernetes cluster scope.</P> <HR /> <H3 id="toc-hId-324541248" class="text-text-100 mt-2 -mb-1 text-base font-bold">Log Module at performance limits</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Periodic gaps in log volume are visible as drops in time-series charts.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">High-throughput pods show intermittently missing logs.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module processes data in 60-second intervals with configurable throughput limits. When log volume exceeds the default limits, the agent falls behind, and gaps appear.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Processing and upload limits are adjustable per environment and are handled individually by Support. Open a support ticket with:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The affected cluster and namespaces.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The approximate log volume from the affected pods.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A screenshot of the volume gap in the time-series chart.</LI> </UL> <HR /> <H3 id="toc-hId-2067351583" class="text-text-100 mt-2 -mb-1 text-base font-bold">Multi-line entries split or merged</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Stack traces, XML payloads, or other multi-line entries appear as multiple separate records (split), or several entries are combined into a single record (merged).</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Behavior may be consistent (always splits/merges at the same point) or intermittent (sometimes correct, sometimes not).</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For consistent split or merge issues, typically caused by timestamp search limits or missing/non-standard timestamp patterns, define a <STRONG>Timestamp/splitting configuration rule</STRONG> that matches your log format.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For step-by-step guidance, see <EM>Troubleshooting log record boundary detection</EM>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For intermittent splits caused by delayed continuation lines (continuation written more than ~60 seconds after the first line), the multi-line timeout is configurable per environment. Contact Dynatrace Support — see the workaround in <EM>Troubleshooting log record boundary detection → Intermittent splitting of multi-line entries with delayed continuation lines</EM>.</P> <HR /> <H3 id="toc-hId--484805378" class="text-text-100 mt-2 -mb-1 text-base font-bold">Timestamp issues are causing entries to be dropped</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are missing for a specific time window.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The Log Module pod logs show:</LI> </UL> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10">&nbsp;</DIV> </DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN> Drop statistics: Out of bound time horizon entries, lower: 0+0, upper: 80</SPAN></CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause&nbsp;</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Dynatrace rejects logs with timestamps more than 15 minutes before the start of ingestion (with a 24-hour grace window after) or more than 10 minutes ahead of the current time (default: 10 minutes ahead). Logs with future timestamps are re-timestamped to the processing time rather than dropped.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Common triggers in Kubernetes deployments:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Application logs in local time, agent assumes UTC.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">System clock skew between the host and the server.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Timestamp pattern not recognized &gt; observation timestamp assigned &gt; may be out of bounds.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Create a <STRONG>Timestamp/splitting configuration rule</STRONG> with an explicit date pattern and timezone for the affected log source.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Accepted timezone values include any IANA timezone identifier (such as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Europe/Warsaw</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">America/Los_Angeles</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Etc/UTC</CODE>), plus the special values <STRONG>Local time zone</STRONG> (agent host timezone) and <STRONG>Default time zone settings</STRONG> (tenant-level default).</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For details on additional triggers (such as JSON fields containing misleading date strings) and resolution steps, see <EM>Troubleshooting missing logs &gt; Entries dropped — timestamp out of bounds</EM>.</P> <H2 id="toc-hId-999267687" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">What's next</H2> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For boundary issues (multi-line entries split incorrectly, entries merged), see <EM>Troubleshooting log record boundary detection</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For broader "missing logs" troubleshooting beyond Kubernetes, see <EM>Troubleshooting missing logs</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For ingest delay (logs arrive but late), see <EM>Troubleshooting log ingest delay</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For JSON parsing issues (wrong timestamp from JSON field, severity mapping), see <EM>Troubleshooting JSON log parsing</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For log rotation issues (gaps at rotation boundaries, missing rotated files), see <EM>Troubleshooting log rotation issues with Log Module</EM>.</LI> </UL> <UL> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId-1673211419" rel="nofollow noopener noreferrer" target="_blank">Table of contents</A></LI> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId--878945542" rel="nofollow noopener noreferrer" target="_blank">Summary</A></LI> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId-863864793" rel="nofollow noopener noreferrer" target="_blank">Problem</A></LI> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId-54518167" rel="nofollow noopener noreferrer" target="_blank">Troubleshooting steps</A></LI> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId-1797328502" rel="nofollow noopener noreferrer" target="_blank">Resolution</A></LI> <LI style="list-style-type: disc; margin-left: 15px; margin-bottom: 1px;"><A href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#toc-hId-999267687" rel="nofollow noopener noreferrer" target="_blank">What's next</A></LI> </UL> Tue, 02 Jun 2026 13:14:16 GMT Kacper 2026-06-02T13:14:16Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H1>Summary</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve / task it will describe.</EM></P> <P>&nbsp;</P> <H1>Problem</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem / task to be described.</EM></P> <P>&nbsp;</P> <H1>Troubleshooting steps</H1> <P><EM>*This section can be omitted.</EM></P> <P>&nbsp;</P> <H1>Resolution</H1> <P><EM>*This section can be omitted for ticket‑creation articles.</EM></P> <H1>What's next</H1> <P><EM>*This is a mandatory section.</EM></P> </DIV> Tue, 02 Jun 2026 13:14:16 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 Kacper 2026-06-02T13:14:16Z